fix: skip credentials for public releases.jfrog.io downloads

[toller892]

Problem

download_to(), head_request(), and storage_request() unconditionally use JF_ACCESS_TOKEN / JF_USER credentials when set — even when downloading from the public releases.jfrog.io server.

This breaks the use case where a user has their own Artifactory credentials configured (JF_URL + JF_USER + JF_PASSWORD) but is not using JF_RELEASES_REPO. The script sends those credentials to releases.jfrog.io, which returns 401 because the user doesn't exist there.

Fixes #1339

Fix

Guard all three HTTP helper functions with a REMOTE_PATH check. Credentials are only sent when JF_RELEASES_REPO is configured (which sets REMOTE_PATH), meaning the URL points to the user's own Artifactory instance. When downloading from the public server, no credentials are sent.

Before

# Always used credentials when set, even for public URLs
if [ -n "${JF_ACCESS_TOKEN:-}" ]; then
    curl -fLg -H "Authorization:Bearer ..." ...

After

# Only use credentials when downloading from user's own Artifactory
if [ -n "${REMOTE_PATH:-}" ] && [ -n "${JF_ACCESS_TOKEN:-}" ]; then
    curl -fLg -H "Authorization:Bearer ..." ...

Affected functions

• download_to() — binary download
• head_request() — HEAD for checksum headers
• storage_request() — Artifactory Storage API fallback

Behavior matrix

Scenario	REMOTE_PATH	Credentials used?
Public download (no JF_RELEASES_REPO)	empty	❌ No
Private Artifactory (JF_RELEASES_REPO set)	set	✅ Yes
No credentials at all	empty	❌ No (unchanged)

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

toller892 seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}